|
| 1 | +# SHAcrypt using SHA-512, after https://akkadia.org/drepper/SHA-crypt.txt. |
| 2 | +# |
| 3 | +# Copyright © 2024 Tony Garnock-Jones. |
| 4 | +# |
| 5 | +# Permission is hereby granted, free of charge, to any person obtaining a copy |
| 6 | +# of this software and associated documentation files (the "Software"), to deal |
| 7 | +# in the Software without restriction, including without limitation the rights |
| 8 | +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 9 | +# copies of the Software, and to permit persons to whom the Software is |
| 10 | +# furnished to do so, subject to the following conditions: |
| 11 | +# |
| 12 | +# The above copyright notice and this permission notice shall be included in all |
| 13 | +# copies or substantial portions of the Software. |
| 14 | +# |
| 15 | +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 16 | +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 17 | +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 18 | +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 19 | +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 20 | +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
| 21 | +# SOFTWARE. |
| 22 | + |
| 23 | +import hashlib |
| 24 | +import secrets |
| 25 | + |
| 26 | +alphabet = \ |
| 27 | + [ord(c) for c in './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'] |
| 28 | +permutation = [ |
| 29 | + [0, 21, 42], [22, 43, 1], [44, 2, 23], [3, 24, 45], |
| 30 | + [25, 46, 4], [47, 5, 26], [6, 27, 48], [28, 49, 7], |
| 31 | + [50, 8, 29], [9, 30, 51], [31, 52, 10], [53, 11, 32], |
| 32 | + [12, 33, 54], [34, 55, 13], [56, 14, 35], [15, 36, 57], |
| 33 | + [37, 58, 16], [59, 17, 38], [18, 39, 60], [40, 61, 19], |
| 34 | + [62, 20, 41], [-1, -1, 63], |
| 35 | +] |
| 36 | +def encode(bs64): |
| 37 | + result = bytearray(4 * len(permutation)) |
| 38 | + i = 0 |
| 39 | + for group in permutation: |
| 40 | + g = lambda j: bs64[j] if j != -1 else 0 |
| 41 | + bits = g(group[0]) << 16 | g(group[1]) << 8 | g(group[2]) |
| 42 | + result[i] = alphabet[bits & 63] |
| 43 | + result[i+1] = alphabet[(bits >> 6) & 63] |
| 44 | + result[i+2] = alphabet[(bits >> 12) & 63] |
| 45 | + result[i+3] = alphabet[(bits >> 18) & 63] |
| 46 | + i = i + 4 |
| 47 | + return bytes(result).decode('ascii')[:-2] |
| 48 | + |
| 49 | +def repeats_of(n, bs): return bs * int(n / len(bs)) + bs[:n % len(bs)] |
| 50 | +def digest(bs): return hashlib.sha512(bs).digest() |
| 51 | + |
| 52 | +def crypt(password, salt = None, rounds = 5000): |
| 53 | + if salt is None: salt = encode(secrets.token_bytes(64))[:16].encode('ascii') |
| 54 | + salt = salt[:16] |
| 55 | + |
| 56 | + B = digest(password + salt + password) |
| 57 | + Ainput = password + salt + repeats_of(len(password), B) |
| 58 | + v = len(password) |
| 59 | + while v > 0: |
| 60 | + Ainput = Ainput + (B if v & 1 else password) |
| 61 | + v = v >> 1 |
| 62 | + A = digest(Ainput) |
| 63 | + |
| 64 | + DP = digest(password * len(password)) |
| 65 | + P = repeats_of(len(password), DP) |
| 66 | + DS = digest(salt * (16+A[0])) |
| 67 | + S = repeats_of(len(salt), DS) |
| 68 | + |
| 69 | + C = A |
| 70 | + for round in range(rounds): |
| 71 | + Cinput = b'' |
| 72 | + Cinput = Cinput + (P if round & 1 else C) |
| 73 | + if round % 3: Cinput = Cinput + S |
| 74 | + if round % 7: Cinput = Cinput + P |
| 75 | + Cinput = Cinput + (C if round & 1 else P) |
| 76 | + C = digest(Cinput) |
| 77 | + |
| 78 | + if rounds == 5000: |
| 79 | + return '$6$' + salt.decode('ascii') + '$' + encode(C) |
| 80 | + else: |
| 81 | + return '$6$rounds=' + str(rounds) + '$' + salt.decode('ascii') + '$' + encode(C) |
| 82 | + |
| 83 | +#--------------------------------------------------------------------------- |
| 84 | + |
| 85 | +def extract_salt_and_rounds(i): # i must be '$6$...' |
| 86 | + pieces = i.split('$') |
| 87 | + if pieces[1] != '6': raise TypeError('shacrypt512 only supports $6$ hashes') |
| 88 | + if pieces[2].startswith('rounds='): |
| 89 | + rounds = int(pieces[2][7:]) |
| 90 | + if rounds < 1000: rounds = 1000 |
| 91 | + if rounds > 999999999: rounds = 999999999 |
| 92 | + return (pieces[3].encode('ascii'), rounds) |
| 93 | + else: |
| 94 | + return (pieces[2].encode('ascii'), 5000) |
| 95 | + |
| 96 | +def password_ok(input_password, existing_crypted_password): |
| 97 | + (salt, rounds) = extract_salt_and_rounds(existing_crypted_password) |
| 98 | + return existing_crypted_password == shacrypt(input_password, salt, rounds) |
| 99 | + |
| 100 | +if __name__ == '__main__': |
| 101 | + _test_password = 'Hello world!'.encode('ascii') |
| 102 | + _test_salt = 'saltstring'.encode('ascii') |
| 103 | + _test_rounds = 5000 |
| 104 | + _test_crypted_password = '$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJuesI68u4OTLiBFdcbYEdFCoEOfaS35inz1' |
| 105 | + assert shacrypt(_test_password, _test_salt, _test_rounds) == _test_crypted_password |
| 106 | + assert password_ok(_test_password, _test_crypted_password) |
| 107 | + |
| 108 | + _test_password = 'Hello world!'.encode('ascii') |
| 109 | + _test_salt = 'saltstringsaltstring'.encode('ascii') |
| 110 | + _test_rounds = 10000 |
| 111 | + _test_crypted_password = '$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh0sbHbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v.' |
| 112 | + assert shacrypt(_test_password, _test_salt, _test_rounds) == _test_crypted_password |
| 113 | + assert password_ok(_test_password, _test_crypted_password) |
| 114 | + |
| 115 | + import sys |
| 116 | + salt = None if len(sys.argv) < 2 else sys.argv[1].encode('ascii') |
| 117 | + print(shacrypt(sys.stdin.readline().strip().encode('utf-8'), salt)) |
0 commit comments